RED×BLUE

Threat Playbook

Adversary vectors paired with the defensive controls that close them. Read top-to-bottom — engagements are sorted by severity. Baseline controls below apply across the surface.

Severe

Moderate

Low

Baseline

Moderate · Plan Mitigation

5 engagements

MODERATER-01↔B-01Expanded derivative theories built from admitted DPA conductHigh

RedR-01

Expanded derivative theories built from admitted DPA conduct

Plaintiff bars with prior RTX standing (Motley Rice, Izard Kindall & Raabe, Milberg Weiss, Berman DeValerio Pease) can use the public DPA admissions plus the Vladimir Gusinsky Del. Sup. Ct. opinion to scaffold next-generation derivative pleadings against any director whose service window touches the admitted conduct. Ekambram (D. Del. 1:26-cv-00081, filed 2026-01-23) is the post-settlement existence proof. Very likely continues to yield filings through the DPA monitor term.

BlueB-01

Expand D&O indemnification disclosure and board-level audit-committee scope around FCPA/AECA conduct

Counter to r_01 and r_06: pre-empt plaintiff scaffolding by publishing fuller D&O indemnification disclosures and granting the audit committee an explicit FCPA/AECA cultural-compliance mandate with public charter changes. Reduces the discount that plaintiff bars currently get from public 2024 admissions + 2001 recidivism citation, and signals to Delaware Chancery that board oversight is now structurally enforced.

MODERATER-03↔B-02Prohibited-export commodity list recoverable from public 8-KHigh

RedR-03

Prohibited-export commodity list recoverable from public 8-K

The granular DDTC consent terms — prohibited-export commodity list, consent term length, monitor coordination — are very likely already on the public web inside EX-99.4 of the October 2024 8-K (0000101829-24-000033). Until extracted, the document is dark; once extracted, the disclosure is permanent.

BlueB-02

Track CourtListener + EDGAR unseal/access activity on October 2024 8-K exhibits and DDTC consent terms

Counter to r_03: instrument continuous monitoring of CourtListener docket-watch and EDGAR access logs for exhibit retrieval activity on 0000101829-24-000033. Where DDTC consent terms permit narrow legal arguments to seal commodity-list portions, exercise those options. Where the disclosure is already public, accept the disclosure and reframe in customer + investor communications rather than waiting for a competitor to reframe it first.

MODERATER-04↔B-03GTF powder-metal record used in airline procurement displacementHigh

RedR-04

GTF powder-metal record used in airline procurement displacement

FAA AD cascade (2022-19-15 → 2023-18114 → 2023-16-07 → 2024-06419) and the Peneycad theory are publicly cited assets for any competitor engine OEM in airline RFPs. Very likely already material to A320neo engine-selection cycles; durability of effect depends on remediation telemetry.

BlueB-03

Proactive airline-customer communication on GTF powder-metal remediation status and durability telemetry

Counter to r_04: out-run the competitor narrative by publishing remediation telemetry (inspected hub counts, replacement counts, fleet-status return-to-service rates) on a defined cadence to airline procurement decision-makers. The competitor-displacement vector lives on information asymmetry; closing that asymmetry directly weakens it.

MODERATER-02↔B-05AECA conviction record weaponized in foreign procurementModerate

RedR-02

AECA conviction record weaponized in foreign procurement

The OpenSanctions crime.traffick topic flag (kj_005 caveat: a taxonomic artifact) plus the admitted AECA / ITAR conduct gives competitor advocates and foreign procurement-watchers a hard hook for compliance-history scoring. Effect is unevenly distributed across markets; likely to manifest in bid-protest contexts before showing as displacement.

BlueB-05

Comprehensive export-control compliance program with explicit reporting to allied procurement counterparties

Counter to r_02: build an export-control compliance program with explicit, periodic reporting to allied procurement counterparties (UK, Australia, Germany, Japan) covering remediation milestones from the DDTC consent. Voluntary, structured disclosure to allied procurement gatekeepers reduces the discount that competitor advocates can extract from the AECA record in bid-protest forums.

MODERATER-05↔B-04Compliance-monitor outputs as recurring FOIA surfaceModerate

RedR-05

Compliance-monitor outputs as recurring FOIA surface

DPA monitor obligations create a multi-year recurring channel for adversary content acquisition. The very FOIA corpora that Wave 5 could not reach (MuckRock, DocumentCloud) are the most likely retrieval points. Plaintiffs in concurrent derivative matters get monitor visibility for free.

BlueB-04

Treat compliance monitor outputs as confidential under DDTC consent terms; preempt FOIA-fishing patterns

Counter to r_05: within the bounds of the DPA / DDTC consent terms, classify monitor outputs as deliberative-process / law-enforcement-privilege protected and rehearse opposition postures for predictable MuckRock / DocumentCloud requests. Where Vaughn-index disclosure is unavoidable, time and shape it to minimize discovery convergence with open civil matters in D. Conn. and D. Del.

Low · Monitor

1 engagement

LOWR-06↔B-01Two-decade recidivism record strengthens plaintiff pleadingsModerate

RedR-06

Two-decade recidivism record strengthens plaintiff pleadings

Citation of In Re Raytheon Securities Litigation (D. Mass. 2001, 41 subsequent citations) together with the 2024 DPA admissions gives plaintiffs a clean historical-knowledge argument. Likely to be invoked in motion-to-dismiss briefing in any future RTX-targeted securities or derivative action.

BlueB-01

Expand D&O indemnification disclosure and board-level audit-committee scope around FCPA/AECA conduct

Baseline · Surface-Wide

2 controls

B-06Baseline

Integrated litigation tracking platform across EDNY / D. Conn. / D. Del. / Del. Sup. Ct.

Baseline control independent of any single red vector: the multi-jurisdictional footprint (kj_006) creates monitor-coordination risk distinct from the substantive litigation. An integrated tracking layer that catches discovery overlaps and parallel-proceeding requests across the four forums reduces inadvertent over-disclosure that any one matter could leverage against another.

B-07Baseline

Refresh ERISA / shareholder-communication procedures post-Darnis settlement

Baseline control: Darnis (ent_023) settled 2022 BEFORE the public FCPA/AECA disclosure cycle. Any subsequent ERISA exposure on the combined post-merger plans intersects with the open securities + derivative cluster. Refreshing fiduciary procedures and shareholder communications around the integrated plan reduces a residual ERISA-second-bite vector that is currently dormant rather than closed.